Ex-IBM red team leaders launch AI attack platform with $7m

Two former leaders of IBM's X-Force Red team have launched RemoteThreat, an offensive security startup with $7 million in pre-seed funding, The Register reported on 29 September 2026. The company sells a platform that uses AI to plan, carry out and adapt offensive cyber operations, which it says goes beyond the continuous penetration testing and vulnerability scanning offered by existing automated tools.

Chief executive Chris Thompson and chief technology officer Shawn Jones previously ran X-Force Red, whose team was hired to test nuclear power plants, critical infrastructure and major banks, according to The Register. In May 2024 Thompson told the publication how X-Force used AI to break into a semiconductor manufacturer's network in eight hours. The pair also created Offensive AI Con, an invitation-only research event whose second edition is scheduled for early October.

Thompson said the founding idea came from watching the current generation of frontier models. "We're looking at how noisy but very capable frontier models are right now, and we started to think: What happens when they can do what we can do as one of the best groups of red-teamers in the world?" he told The Register. His stated concern is that AI could produce custom malware approaching the quality used by state-sponsored attackers, then deploy it at speed and scale.

The company has 15 employees, drawn from X-Force Adversary Services, Mandiant, SpecterOps, Dreadnode, Bugcrowd, Microsoft, defence contractors and government agencies, according to the startup. RemoteThreat describes its platform as eight connected systems covering mission planning, command and control, implants, initial access, advanced attack capabilities, obfuscation, analysis and AI-assisted operations.

RemoteThreat says the platform uses small, purpose-built models for some tasks, and that customers can also connect models from OpenAI or Anthropic, or use an open-weight alternative. Whichever model is chosen gets access to what Thompson described as "1,000 tools that we've built from scratch". The system can be run by humans or by AI agents, he said, with customers able to "drive a lot of this testing from your Codex terminal instead of having to log into our website, for example".

Given the potential for misuse, the company says access is restricted to vetted enterprises, defence contractors and US government customers. It says existing customers include a major bank, a securities exchange operator, a large US healthcare company and a leading AI lab. "We're focused on preparing these Fortune 500 organizations to better simulate this nation-state level of attack," Thompson said, adding that the other half of the business is to "provide the government with the tooling to target their adversaries as quickly as possible".

The startup says its capabilities can run as a complete platform or be built into partners' products. It has teamed up with Talon Defense, which supplies AI and cyber technology to national security, defence and intelligence customers, and with the Nakasone Group, the advisory firm founded by retired US Army Gen. Paul Nakasone, former director of the National Security Agency and commander of US Cyber Command. Nakasone is also a strategic adviser to the company. RemoteThreat says it has joined US Special Operations Command's SOF RACER consortium, a route for supplying capabilities to special operations forces.

The Register notes the launch follows a US Cyber Strategy published in March that calls for closer industry cooperation on defensive and offensive missions, and an August presidential memorandum ordering a programme under which vetted US companies may conduct cyber operations against foreign cybercrime groups under federal direction and oversight. "It's a bit of a gold rush in this space," Thompson said.